Password Depot

What Is Password Depot?

You want a password manager that doesn’t force your secrets into someone else’s cloud—and you don’t want to build a whole self-hosted stack just to get decent autofill. Password Depot is built for that middle ground: a “local-first” password manager where your vault is a database file you control, and syncing is something you choose (cloud drive, WebDAV/SFTP, or a company-run server you host). (password-depot.de)

This approach is a good fit for people who value data sovereignty and are comfortable managing where their encrypted database lives. It’s also aimed at organizations that want central control without a vendor-hosted SaaS: Password Depot’s business positioning emphasizes on-prem deployment (or inside your Azure tenant), centralized rights management, audit logs, and integrations for identity and automation. (password-depot.de)

The distinctive part isn’t “better encryption” marketing—it’s control over storage and deployment. Personal users can keep databases locally or in the cloud storage provider of their choice; teams can run Password Depot Enterprise Server with permissions, logging, and SSO/MFA options. That flexibility comes with a cost: you’re responsible for making good choices about where you store and sync the encrypted database. (password-depot.de)

Password Depot Features and Performance

Password Depot’s core model is file-based vaults (you can create multiple databases). Unlike many subscription managers where everything sits behind a single online account, you can store the database wherever you want, then open it from each device. The vendor explicitly supports syncing via common cloud storage paths (like OneDrive and Dropbox), and also supports connecting to “your own” storage over protocols like WebDAV (including SSL/TLS), FTP/SFTP/FTPS, and HTTP/HTTPS. (password-depot.de)

On Windows, browser autofill is handled via dedicated add-ons for Chrome, Firefox, and Edge. The documentation states the add-ons communicate with the Windows client using Native Messaging (i.e., the extension talks to a locally installed desktop client rather than directly holding the whole vault logic in the extension). The add-ons can also offer to save new logins, generate passwords, and run a breach check for a password.

A few practical performance implications fall out of this architecture:

• Sync speed depends on your storage choice. Password Depot saves changes directly to your chosen storage location; other devices load the updated state when they next open the database. That can be fast (local LAN/WebDAV) or slow/fragile (high-latency storage, flaky mobile connectivity)—but that’s a property of your sync target, not a vendor cloud service tuned specifically for vault sync. (password-depot.de)
• Version compatibility matters. Password Depot notes that databases encrypted with AES-GCM can’t be opened by older client versions (specifically: 19.1.0 or earlier). In practice, that means keeping all your devices updated if you want to avoid “can’t open vault” surprises. (password-depot.de)

On the cryptography front, Password Depot’s release notes for the personal Windows client state new databases use AES-GCM authenticated encryption by default, with classic AES-CBC still available. The same notes also mention moving random generation to Windows CNG for password/passphrase generation features. (personal.password-depot.de)

For team and enterprise scenarios, Password Depot’s business site claims it can manage not only passwords but also TOTP codes, SSH keys, certificates, API tokens, and secure files, with audit logs and a REST API for integrations (including DevOps and automation workflows). It also describes identity integration (Active Directory and Microsoft Entra ID), SSO, and MFA methods including FIDO2/WebAuthn and TOTP. (password-depot.de)

Platform coverage is broader than “Windows-only,” but it’s not symmetrical. Official docs indicate:

• Windows is the primary, full-featured client.
• iOS and Android apps exist and are free to use.
• macOS is free to use without a license key (per the macOS quickstart guide).
• Linux exists, is free of charge, and is under active development, explicitly not yet 1:1 with Windows features.

That last point is the “real world” trade-off: Password Depot’s ecosystem is cross-platform, but if you expect identical feature parity everywhere, Linux in particular is still catching up.

Pricing and Plans

For personal use (Windows), Password Depot is sold as a one-time purchase (not a subscription) for the Windows client. The official order page lists three purchase options:

• New license: 99,95 € (one-time purchase, no subscription)
• Upgrade: 79,95 € (one-time purchase)
• Family: 149,95 € (one-time purchase, 5 licenses, up to five people)

The same page also states the iOS and Android apps and the macOS app are included free of charge with the Windows purchase.

There is also an official free trial: the download page states Password Depot for Windows works as a full version for 30 days.

For businesses / Enterprise Server licensing, Password Depot doesn’t publish a simple public price list in the same way. The licensing page describes a maintenance model (you can purchase one, two, or three years of maintenance; later upgrades/renewals depend on maintenance status) and directs buyers to contact sales for pricing details. In other words: expect quote-based pricing for enterprise deployment, with maintenance as a key part of staying current.

Refund terms: I did not find a definitive, current official refund/withdrawal window in the sources retrieved for this review, so I’m not going to guess.

Privacy and Security Assessment

Jurisdiction: Password Depot is developed by AceBIT GmbH in Germany (your database also confirms jurisdiction: Germany). Germany is an EU jurisdiction, so GDPR compliance and EU legal frameworks apply. That doesn’t automatically make a product “private,” but it’s a clearer regulatory environment than many offshore jurisdictions. (password-depot.de)

Architecture and data exposure: Password Depot’s “no forced cloud” design is real: the official FAQ explicitly supports using your own storage (Nextcloud/WebDAV and other servers via multiple protocols), and the business site emphasizes on-prem or Azure-tenant deployment for teams. That reduces reliance on a vendor-hosted vault service—but it also shifts risk onto your storage decisions and operational hygiene. If you sync your encrypted vault through a weak or misconfigured storage setup, that’s on you. Cloudwards makes the same point bluntly: the tool leans toward encryption software plus password features, and “syncing and authentication” are effectively your responsibility unless you run an enterprise server. (password-depot.de)

Encryption details: Password Depot’s release notes state new databases default to AES-GCM authenticated encryption with Windows CNG, while keeping AES-CBC as an option for classic mode / existing databases. AES-GCM is generally the more modern choice because it provides integrity/authentication in addition to confidentiality, but the main point here is: authenticated encryption is explicitly called out in their current Windows release notes. (personal.password-depot.de)

Independent testing / audits: Password Depot publishes a Trust Center page stating Password Depot 19.0.0 underwent an external penetration test by SySS GmbH, with a certificate indicating no critical vulnerabilities were identified within the agreed scope and time period (10 person-days; testing period Dec 1–23, 2025; certified Jan 20, 2026). This is not a full public-code audit, and the detailed report isn’t public, but it is at least a named third-party assessment with dates and scope description.

AceBIT also claims its information security management system (ISMS) is certified to ISO/IEC 27001:2022 by TÜV NORD. That’s a company/process certification, not proof that the product is bug-free—but it does indicate formal security management practices. (password-depot.de)

Open-source posture: Password Depot is not presented as an open-source password manager. However, the official download page references “Open Source on GitHub” with “request access,” which suggests at least some code is shared in a controlled way rather than publicly open. Since that wording is ambiguous and I didn’t retrieve the actual repository content or scope, I’m not treating this as a fully open-source product.

Known criticisms and caveats (documented):

• Usability and “feature creep” are a recurring complaint in at least one detailed third-party review. Cloudwards describes the product as robust but option-heavy and less streamlined than competitors. (cloudwards.net)
• Extension reliability appears mixed in the wild. An extension-permissions/review synthesis page reports polarized feedback and mentions users reporting the extension as non-functional. This is not as strong as a lab test, but it’s a signal that browser integration may be more brittle than best-in-class competitors depending on version and setup.

I did not find a clearly documented major breach or widely reported incident specific to Password Depot in the sources pulled here, so I’m not going to imply one.

Strengths and Limitations

Strengths

• No vendor cloud requirement. You can keep databases local, sync via your own storage, or deploy on-prem/Azure tenant for teams. (password-depot.de)
• One-time purchase for personal Windows. Clear non-subscription pricing for individuals and families.
• Modern browser add-on integration (Windows). Add-ons for Chrome/Firefox/Edge using Native Messaging; supports saving logins, generating passwords, and breach checking.
• Security hardening shows up in release notes. Examples include AES-GCM default for new databases and changes around clipboard handling. (personal.password-depot.de)
• Named third-party pentest certificate (point-in-time). SySS pentest stated no critical findings in scope/timeframe.

Limitations

• You own the sync risk. Great for sovereignty; not great if you want “it just works” cloud vault sync with minimal decisions. (cloudwards.net)
• Cross-platform feature parity isn’t guaranteed. The Linux client is explicitly not yet equivalent to Windows and is still growing feature-by-feature.
• Browser add-ons depend on the desktop client. The Firefox listing notes it’s not standalone; it communicates with the desktop client via Native Messaging. That’s fine on a personal PC, but it’s a constraint compared to fully standalone extensions.
• Version mismatch can lock you out. AES-GCM databases require newer clients; older versions won’t open them. (password-depot.de)
• Not a “simple” password manager. At least one detailed review calls out complexity and customization overhead. (cloudwards.net)

Who Should Use Password Depot?

Good fits

1. Local-first users who refuse vendor-hosted vaults. If you want your password database as a file you can store anywhere (including your own WebDAV/Nextcloud), Password Depot is designed for that workflow. (password-depot.de)
2. Windows-centric power users who want deep control. If you like lots of settings and a traditional desktop workflow (plus browser add-ons tied to the desktop client), Password Depot matches that style.
3. Organizations needing on-prem control + auditing. The business positioning is clear: server-based rights management, audit logs, and identity integrations, deployed in your data center or Azure tenant. (password-depot.de)

Not great fits

1. People who want effortless “one account, everything syncs” convenience. Password Depot can sync, but it makes you choose and manage the storage model. (cloudwards.net)
2. Linux-first users expecting full parity today. The Linux client is explicitly still developing and not 1:1 with Windows features.
3. Anyone who needs a standalone browser extension. At least for Firefox, the extension explicitly isn’t standalone and relies on the desktop client via Native Messaging.